Should you use Tailscale, Pangolin, ZeroTier, or NetBird to remotely access your home lab?

Whether your home lab is still in the virtual planning stages or has grown into a cluster of mini PCs, soon enough, you’ll want a way to connect to it remotely. After all, there’s not much point in self-hosting services to improve your life if you can’t access them when outside.

While you could go for a traditional VPN, and connect to your home network that way, those come with headaches, added complexity, and the worry that they won’t connect when you most need them. Plus, modern connectivity options are so much better, especially when they’re built on WireGuard or similar protocols. We’ve covered most of these options in depth, but which one of these four options will suit your home lab? That depends on your priorities, but know that all of them are good options; they have a few key differences.

That depends, but they’re all excellent to use and easy to set up

When deciding on a remote access tool for your home lab, it’s all about priorities. Do you want to self-host everything? Are you okay with ceding some control to another company to simplify your setup? Do you want SSO, or are you okay with using a single shared network key to connect your devices together? Oh, and cost, because that’s always important to know, as is the level of technical knowledge you’ll need.

Now, while some of these are easier to set up than the rest, they’re not much more complicated, and I’ve managed to get all of them running within a couple of hours of research and testing. If you’re already familiar with reverse proxies, Pangolin will be a breeze. If you want something that works without any effort at all but is limited in how many devices you can connect at once, Tailscale or ZeroTier are good options, which do the same job but slightly differently. NetBird is somewhere in between, but has added team-focused features and automation options.

Let’s talk features and protocols

Three of the four use WireGuard as their encrypted connectivity protocol, with ZeroTier opting for their custom protocol. ZeroTier’s protocol puts a virtual network switch over the Internet, so you can add devices and VLANs and interconnect them in the way you want, so they’re not all necessarily able to talk to each other. That also means ZeroTier can do multicast over the internet, which is a unique selling point.

Only Pangolin wants you to self-host the control server and set everything up from scratch. Still, the other three have tools to self-host the control plane that makes the mesh VPN connectivity work, whether from an enterprise plan or a community edition that’s not officially supported, but isn’t entirely frowned upon either.

*Self-hosting requires enterprise plans or community editions.

All four have NAT traversal skills because they’re all connecting your devices through an intermediary server to begin with, so even the strictest firewalls or ISP connections are no problem. That’s one of the big pluses for the new generation of remote connectivity tools, because you don’t have the issues around needing open ports of a traditional VPN solution.

They’re all suitable for remote access security-wise, but some have more control than others. They can all be set up to only add new devices to the network if an admin approves them, though, and I recommend this no matter how you’re setting them up. NetBird seems to have the most fine-grained control, although ZeroTier has strong segmentation options, Pangolin is as secure as you make it with additional plugins, and Tailscale is inherently secure.

Related

3 tools to monitor and manage your NAS remotely

There are many ways to manage and monitor your NAS when not next to it.

The choice is yours

Do you want simplicity or extensible complexity

You can’t go wrong with any of these choices, but it depends on how much work you want to put in to get things running in the first place. Pangolin is absolutely the most work, but it’s also rewarding and teaches you about reverse proxy configuration at the same time thanks to the Traefik core, and it gives you the most control. Tailscale is the other end of the spectrum, ceding some measure of control to the company’s servers, but you can be running in minutes thanks to simple installation.

ZeroTier gives you multicast support, which could be crucial if your home lab is full of IoT devices, but it’s also the one with the lowest device limit before you have to pay. And NetBird is quick to deploy, but will take some time to organize security policies around your needs.

Pricing for home lab users depends on the number of devices needed:

• Tailscale: Free for up to 100 devices connected to the Tailnet
• Pangolin: Free and open-source, but you’ll need your own VPS and a domain name to host the control server
• ZeroTier: Free for up to 25 devices
• NetBird: Free for up to ten users

For many home lab users, the generous pricing restrictions mean they’ll not pay a penny for their remote access tool. If they outgrow those limits, pricing can vary, but it’s not terrible for any of them.

Accessing your home lab remotely is a personal choice

Whether you want simple remote access to get at your self-hosted projects, a remote server with both reverse proxy and remote access, or something in-between, the choice is yours. Maybe you want the easiest option to get running, which is Tailscale. ZeroTier isn’t far off, and then NetBird and Pangolin are of increasing complexity. But it’s true enough that you get back what you put in, and sometimes the extra setup time gives you skills that make other tasks easier in the future.